The AI Risk Most SMEs Don't Know Is Just Around the Corner

When people ask which pattern in AI adoption concerns me most, they tend to expect something about the technology itself, but my answer sits elsewhere, and it is almost a double-edged sword. The pattern that worries me most is not the development of business software; it is the protection of it.

Specifically, I am referring to the implications of Anthropic's frontier model, Claude Mythos, and the initiative built around it, Project Glasswing. Mythos is a general-purpose model that happens to be exceptionally capable at reading, understanding and modifying complex code, and that same capability allows it to find software vulnerabilities at a depth and speed that, until very recently, sat well beyond most human teams. In its early use it has surfaced thousands of previously undiscovered vulnerabilities across critical infrastructure and widely used open-source software, a number of which had been sitting undisturbed for a decade or more.

Anthropic has chosen not to release the model publicly, and has instead granted access through Project Glasswing to twelve launch partners and more than forty further organisations, over fifty in total, including some of the largest technology and infrastructure providers in the world, so that they can begin to find and patch weaknesses in their existing technology before anyone with hostile intent can exploit them. That is the right instinct, and it is a serious piece of work, but it is also where my concern begins.

A capability of this kind does not stay contained indefinitely. Whether through an eventual, safeguarded release or through adversaries reaching equivalent capability of their own, the ability to scan ordinary software for exploitable weaknesses will in time become far more widely available than it is today; and at that point, legacy software across the SME economy faces a genuine fight to survive. The window between a vulnerability being discovered and a vulnerability being exploited has already narrowed from months to minutes, and the organisations inside Project Glasswing are preparing for precisely this. The concern is everyone else.

Most of the SME economy runs on legacy software, on systems that were built years ago, are no longer actively maintained, and have never been examined with tools of this strength. For most of their working life that has been acceptable, because the effort required to find their weaknesses was itself a meaningful barrier; as that barrier falls, a great deal of software that has quietly done its job for years will be exposed in a way it never has been before.

I do not raise this to create alarm, and it is, if anything, the opposite of the hype that usually surrounds these announcements. I raise it because, in my experience, very few firms outside the largest enterprises are aware of this shift, and fewer still are ready for it. The work of preparing is measured and entirely achievable, but it has to begin before the risk becomes visible rather than after, and that is a question of sequencing and priorities far more than it is a question of budget or headcount.

The firms that treat this as a foundational issue now will be in a markedly stronger position than those who wait for the problem to announce itself. By the time this capability is widely felt, the work of preparing for it should already be done; and at present, I do not think most firms are aware of that, let alone ready for it.

If it would be helpful to think through where your own exposure sits, we would be very happy to have that conversation.

#AIImplementation #AIConsulting #AIAdoption #Cybersecurity #AISecurity #SME #SoftwareSecurity #AIGovernance